Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
15-05-2024 03:42
Static task
static1
Behavioral task
behavioral1
Sample
0513304ac8178fa00bce7b395fa824d0.exe
Resource
win7-20240215-en
General
-
Target
0513304ac8178fa00bce7b395fa824d0.exe
-
Size
386KB
-
MD5
0513304ac8178fa00bce7b395fa824d0
-
SHA1
a10f045ae42a32cc223fb81d121a074f1cfb6085
-
SHA256
08acad39a18e3a380043252aaa097232c57f3e1b0e587d4fb88351b28698f942
-
SHA512
039619a83b493790bc47010daa09f657a597009a77d7639b22a37346ce9fb6fce83e906f4a68cc6575a33d9ccebe8cd1662d856de3c32cfe7c235316c4f39e9a
-
SSDEEP
6144:TcykrZfMtgEBXGx0Xy5gul0n4Qgf3ONjMMejZxxXx+0jTw3I:TcyktfW/tXZbgf3ONj7elxJw3I
Malware Config
Extracted
stealc
http://185.172.128.150
-
url_path
/c698e1bc8a2f5e6d.php
Signatures
-
Detect ZGRat V1 3 IoCs
resource yara_rule behavioral1/memory/1192-129-0x0000000000BB0000-0x00000000043E4000-memory.dmp family_zgrat_v1 behavioral1/memory/1192-130-0x000000001F120000-0x000000001F22A000-memory.dmp family_zgrat_v1 behavioral1/memory/1192-134-0x00000000005A0000-0x00000000005C4000-memory.dmp family_zgrat_v1 -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
pid Process 2276 uyg.0.exe 2664 uyg.1.exe -
Loads dropped DLL 10 IoCs
pid Process 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 1240 0513304ac8178fa00bce7b395fa824d0.exe 2276 uyg.0.exe 2276 uyg.0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uyg.1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uyg.1.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uyg.1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uyg.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString uyg.0.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2276 uyg.0.exe 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1192 SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe -
Suspicious use of SendNotifyMessage 7 IoCs
pid Process 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe 2664 uyg.1.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2276 1240 0513304ac8178fa00bce7b395fa824d0.exe 28 PID 1240 wrote to memory of 2276 1240 0513304ac8178fa00bce7b395fa824d0.exe 28 PID 1240 wrote to memory of 2276 1240 0513304ac8178fa00bce7b395fa824d0.exe 28 PID 1240 wrote to memory of 2276 1240 0513304ac8178fa00bce7b395fa824d0.exe 28 PID 1240 wrote to memory of 2664 1240 0513304ac8178fa00bce7b395fa824d0.exe 29 PID 1240 wrote to memory of 2664 1240 0513304ac8178fa00bce7b395fa824d0.exe 29 PID 1240 wrote to memory of 2664 1240 0513304ac8178fa00bce7b395fa824d0.exe 29 PID 1240 wrote to memory of 2664 1240 0513304ac8178fa00bce7b395fa824d0.exe 29 PID 2664 wrote to memory of 1192 2664 uyg.1.exe 32 PID 2664 wrote to memory of 1192 2664 uyg.1.exe 32 PID 2664 wrote to memory of 1192 2664 uyg.1.exe 32 PID 2664 wrote to memory of 1192 2664 uyg.1.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\0513304ac8178fa00bce7b395fa824d0.exe"C:\Users\Admin\AppData\Local\Temp\0513304ac8178fa00bce7b395fa824d0.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\uyg.0.exe"C:\Users\Admin\AppData\Local\Temp\uyg.0.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\uyg.1.exe"C:\Users\Admin\AppData\Local\Temp\uyg.1.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe"C:\Users\Admin\AppData\Local\Temp\iolo\dm\SystemMechanic_5488CB36-BE62-4606-B07B-2EE938868BD1.exe" /eieci=11A12794-499E-4FA0-A281-A9A9AA8B2685 /eipi=5488CB36-BE62-4606-B07B-2EE938868BD13⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\ApplicationInsights\252e99e709753c2ab04b66e213ab7d72cfdb494a7016e07d23bc17fe7cebab94\ab4bc1f0f13c4b8d8c601d5b63a4f2db.tmp
Filesize1KB
MD56807287834bfb63b473f85ce316b3629
SHA1c468b496410c0cb6dc067884209c96ed7e82ea18
SHA2563e4db65fa7a7a57f37bb73a399aa73d7f6313bd861c79a3333717286de13a8ba
SHA512b13e70c5cbdf048523a7dedd8b6d1301fd67e83c90eb6a101920fc612c587147195cc201354615989972d7246cb7a313416c8a8e94e3f7452cb231fb84f786b5
-
Filesize
3KB
MD5a1330cf180f11c3af036ab1cb4ff31c1
SHA14e7b626ea1d950f5b5aa7df44bba0d976ff1aec0
SHA256b731d474ed09fd8900cfca46a90a5ab2084d2c836908fa8b48edc3ae61e8c3ca
SHA512a089a1e79b86ee4ab747c36d4fd9ee8002d442aa8e0ea4eb55255f18f7654758816b1ede2388ddc82696b068e94ad896f1e1cb8dd3a7740eb5362699d67636bf
-
Filesize
2KB
MD51be7e7abbdb1938f99f89333187bc336
SHA13564ae67d0381130467ab25f83d31e92c44e0155
SHA25688159a70109567de5a0ea27a60c72b194368965775376a9ed98a808a7239f450
SHA512d135202d38efd1113af5e4574cf1f4d209ad6d83284d7db9ad3cae3bba12dfc0744ee4ee366e4217d3c9fb4608be1600184de7452efa098acbfd334d4d0c0285
-
Filesize
593KB
MD5c8fd9be83bc728cc04beffafc2907fe9
SHA195ab9f701e0024cedfbd312bcfe4e726744c4f2e
SHA256ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
SHA512fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040
-
Filesize
2.0MB
MD51cc453cdf74f31e4d913ff9c10acdde2
SHA16e85eae544d6e965f15fa5c39700fa7202f3aafe
SHA256ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
SHA512dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571
-
Filesize
239KB
MD5431c601846123a7b4aa67d75e31a3dfd
SHA10704a6551c01b3b5744e7b743b33ffa5be2b4ced
SHA2560a9eab89753e07a01b1c5e0197acefea9cc05e5f7829823f811e7aa1d7b817b7
SHA51287a0f6eb99baf620b25216ba491f4891154224ad44ecbbe209c5189585d4cc8abea25ef7b34d78608f074c00ce76374fe49252d76b693521363aced52e4cda27
-
Filesize
4.6MB
MD5397926927bca55be4a77839b1c44de6e
SHA1e10f3434ef3021c399dbba047832f02b3c898dbd
SHA2564f07e1095cc915b2d46eb149d1c3be14f3f4b4bd2742517265947fd23bdca5a7
SHA512cf54136b977fc8af7e8746d78676d0d464362a8cfa2213e392487003b5034562ee802e6911760b98a847bddd36ad664f32d849af84d7e208d4648bd97a2fa954